35c3 Alberto's story of hacking, love, death experience and prison Alberto Daniel Hill

1
00:00:00,560 –> 00:00:06,319
so you could also look at the

2
00:00:02,639 –> 00:00:06,319
data privacy regulations that they have

3
00:00:07,759 –> 00:00:11,280
and maybe you have a right to be

4
00:00:09,360 –> 00:00:13,280
forgotten

5
00:00:11,280 –> 00:00:15,040
there are companies that only save their

6
00:00:13,280 –> 00:00:17,760
locks for seven days

7
00:00:15,040 –> 00:00:20,560
maybe you just need to wait

8
00:00:17,760 –> 00:00:22,160
so generally be careful when being a

9
00:00:20,560 –> 00:00:24,320
data traveler

10
00:00:22,160 –> 00:00:27,439
this also plays our friend alberto from

11
00:00:24,320 –> 00:00:29,119
uruguay who

12
00:00:27,439 –> 00:00:30,560
at the afternoon was on his computer

13
00:00:29,119 –> 00:00:31,760
with his girlfriend

14
00:00:30,560 –> 00:00:34,640
and he

15
00:00:31,760 –> 00:00:34,640
was looking at a cloud

16
00:00:35,200 –> 00:00:42,000
and he said oh well health data

17
00:00:38,640 –> 00:00:43,040
have they got an admin oops

18
00:00:42,000 –> 00:00:45,520
oops

19
00:00:43,040 –> 00:00:47,200
you see that was the oops

20
00:00:45,520 –> 00:00:50,239
so he wrote the mail

21
00:00:47,200 –> 00:00:50,239
to serge uruguay

22
00:00:51,440 –> 00:00:54,640
central authority

23
00:00:53,120 –> 00:00:56,800
of the country

24
00:00:54,640 –> 00:01:00,000
this is about health records

25
00:00:56,800 –> 00:01:02,559
and he received a very fast a response

26
00:01:00,000 –> 00:01:05,920
by the director of cert

27
00:01:02,559 –> 00:01:05,920
so they took this very seriously

28
00:01:06,960 –> 00:01:09,920
maybe this wasn’t so dramatic because

29
00:01:08,720 –> 00:01:11,520
the hacker

30
00:01:09,920 –> 00:01:12,479
wasn’t really about to do anything so

31
00:01:11,520 –> 00:01:15,280
this was

32
00:01:12,479 –> 00:01:18,400
maybe not that bad

33
00:01:15,280 –> 00:01:20,320
for him this was over

34
00:01:18,400 –> 00:01:22,320
he had notified cert

35
00:01:20,320 –> 00:01:24,000
they had taken responsibility they will

36
00:01:22,320 –> 00:01:26,320
deal with this

37
00:01:24,000 –> 00:01:28,560
alberta was to carry on with his life as

38
00:01:26,320 –> 00:01:31,119
normal but then after one year he

39
00:01:28,560 –> 00:01:34,079
realized that

40
00:01:31,119 –> 00:01:34,960
well they closed the admin admin but now

41
00:01:34,079 –> 00:01:37,520
they have

42
00:01:34,960 –> 00:01:38,720
unauthenticated file access so maybe

43
00:01:37,520 –> 00:01:40,880
i’ll just

44
00:01:38,720 –> 00:01:42,479
go and sort of notify cert

45
00:01:40,880 –> 00:01:44,880
again

46
00:01:42,479 –> 00:01:47,040
sometime past about

47
00:01:44,880 –> 00:01:50,479
two years of silence

48
00:01:47,040 –> 00:01:50,479
he had already forgotten about this

49
00:01:50,560 –> 00:01:54,479
and then the company that has those

50
00:01:52,720 –> 00:01:58,320
health records

51
00:01:54,479 –> 00:02:01,520
and they get an email from somebody

52
00:01:58,320 –> 00:02:01,520
saying give us bitcoin

53
00:02:05,520 –> 00:02:11,520
and the person blackmailing them said

54
00:02:08,879 –> 00:02:14,080
that they had the health records and if

55
00:02:11,520 –> 00:02:16,480
they wouldn’t transfer 15 bitcoins

56
00:02:14,080 –> 00:02:20,840
in a certain amount of time

57
00:02:16,480 –> 00:02:20,840
they would go to the press

58
00:02:24,080 –> 00:02:29,440
of all people who are hiv positive

59
00:02:28,239 –> 00:02:31,680
i’m not sure the press would have been

60
00:02:29,440 –> 00:02:33,120
interested but the police was certainly

61
00:02:31,680 –> 00:02:35,040
interested

62
00:02:33,120 –> 00:02:37,200
you always need to think about the

63
00:02:35,040 –> 00:02:38,720
police

64
00:02:37,200 –> 00:02:42,239
you can

65
00:02:38,720 –> 00:02:42,239
identify them by these hats

66
00:02:43,040 –> 00:02:46,800
there is a star

67
00:02:44,959 –> 00:02:49,360
at the front of the hat

68
00:02:46,800 –> 00:02:52,160
so just so you don’t forget

69
00:02:49,360 –> 00:02:54,480
so somebody wants bitcoin now

70
00:02:52,160 –> 00:02:55,680
and again for a while nothing happens

71
00:02:54,480 –> 00:02:58,159
and then

72
00:02:55,680 –> 00:03:00,400
alberto’s door is kicked in

73
00:02:58,159 –> 00:03:03,280
his house is searched again brute force

74
00:03:00,400 –> 00:03:03,280
attempt as we know it

75
00:03:03,360 –> 00:03:07,280
and now this happens

76
00:03:05,200 –> 00:03:09,360
the police

77
00:03:07,280 –> 00:03:10,959
can’t believe their eyes

78
00:03:09,360 –> 00:03:14,080
when they enter this apartment because

79
00:03:10,959 –> 00:03:16,840
they find so many interesting things

80
00:03:14,080 –> 00:03:20,400
that they will say at a later press

81
00:03:16,840 –> 00:03:23,040
conference and talk about this and

82
00:03:20,400 –> 00:03:26,080
sort of exhibit all their findings

83
00:03:23,040 –> 00:03:28,000
look like this in the picture

84
00:03:26,080 –> 00:03:30,080
stacks of credit cards

85
00:03:28,000 –> 00:03:34,319
blank credit cards

86
00:03:30,080 –> 00:03:34,319
tend to not make the best impression

87
00:03:35,120 –> 00:03:40,239
this is true for uh the supermarket but

88
00:03:37,920 –> 00:03:42,720
also in your

89
00:03:40,239 –> 00:03:46,280
cupboard when the police comes around

90
00:03:42,720 –> 00:03:46,280
also card readers

91
00:03:50,400 –> 00:03:53,840
so they

92
00:03:51,519 –> 00:03:56,720
set this up very nicely

93
00:03:53,840 –> 00:03:57,920
cards cut readers everything

94
00:03:56,720 –> 00:04:01,360
the question would be if the police

95
00:03:57,920 –> 00:04:03,519
actually thought about upset and maybe

96
00:04:01,360 –> 00:04:06,239
censored the credit card numbers we’re

97
00:04:03,519 –> 00:04:06,239
never gonna know

98
00:04:06,480 –> 00:04:11,200
and of course what you find at any

99
00:04:09,040 –> 00:04:13,040
hackers or criminals house

100
00:04:11,200 –> 00:04:15,040
what do you find of course

101
00:04:13,040 –> 00:04:16,560
the mask of anonymous

102
00:04:15,040 –> 00:04:20,000
anonymous

103
00:04:16,560 –> 00:04:23,040
they find the mask they also exhibit it

104
00:04:20,000 –> 00:04:24,880
we don’t have a mask with us

105
00:04:23,040 –> 00:04:29,240
strategic concerns

106
00:04:24,880 –> 00:04:29,240
and strategic money reserves

107
00:04:37,830 –> 00:04:43,840
[Applause]

108
00:04:42,160 –> 00:04:45,759
and that’s what the

109
00:04:43,840 –> 00:04:47,280
blackmailer wanted

110
00:04:45,759 –> 00:04:49,120
so case closed

111
00:04:47,280 –> 00:04:52,160
one and one bitcoin

112
00:04:49,120 –> 00:04:52,160
added up together

113
00:04:52,710 –> 00:04:54,840
[Music]

114
00:04:54,160 –> 00:04:58,240
so

115
00:04:54,840 –> 00:05:00,320
questionings threats

116
00:04:58,240 –> 00:05:03,039
police incompetence

117
00:05:00,320 –> 00:05:05,120
and what alberto does is

118
00:05:03,039 –> 00:05:06,800
confessing falsely

119
00:05:05,120 –> 00:05:08,800
hoping that

120
00:05:06,800 –> 00:05:11,199
during the following procedures

121
00:05:08,800 –> 00:05:13,280
he would meet competent people but that

122
00:05:11,199 –> 00:05:17,039
hope

123
00:05:13,280 –> 00:05:19,520
was wrong he spends eight months in jail

124
00:05:17,039 –> 00:05:23,880
in prison and he is

125
00:05:19,520 –> 00:05:23,880
left out on bail at the moment

126
00:05:25,039 –> 00:05:31,360
he’s very sure that he didn’t do this

127
00:05:27,840 –> 00:05:33,840
because after responsibly disclosing

128
00:05:31,360 –> 00:05:36,560
information you don’t send

129
00:05:33,840 –> 00:05:36,560
a blackmail

130
00:05:36,639 –> 00:05:41,440
especially

131
00:05:38,880 –> 00:05:43,120
if it says please transfer 15 bitcoins

132
00:05:41,440 –> 00:05:44,479
to the following

133
00:05:43,120 –> 00:05:46,479
account

134
00:05:44,479 –> 00:05:49,120
without actually giving the account or

135
00:05:46,479 –> 00:05:49,120
the wallet number

136
00:05:50,560 –> 00:05:56,479
so as we have took some fun at alberto

137
00:05:53,280 –> 00:05:58,720
we actually contacted him and he had to

138
00:05:56,479 –> 00:06:02,720
say a few things

139
00:05:58,720 –> 00:06:02,720
and we welcome him to our video screen

140
00:06:04,800 –> 00:06:09,280
after spending eight months in prison

141
00:06:07,600 –> 00:06:10,160
i have to tell you that i learned many

142
00:06:09,280 –> 00:06:12,560
things

143
00:06:10,160 –> 00:06:15,360
one of them was that i should know how

144
00:06:12,560 –> 00:06:16,400
to manage the truth

145
00:06:15,360 –> 00:06:17,199
when

146
00:06:16,400 –> 00:06:18,160
who

147
00:06:17,199 –> 00:06:20,720
where

148
00:06:18,160 –> 00:06:24,160
how much information you share are key

149
00:06:20,720 –> 00:06:26,319
elements in order to stay out of trouble

150
00:06:24,160 –> 00:06:27,600
after hearing my story people tell me

151
00:06:26,319 –> 00:06:29,759
that the learning is that they should

152
00:06:27,600 –> 00:06:32,160
not report security incidents

153
00:06:29,759 –> 00:06:33,520
and for me that is sad

154
00:06:32,160 –> 00:06:35,440
report them

155
00:06:33,520 –> 00:06:37,440
i don’t report them anymore because i

156
00:06:35,440 –> 00:06:38,800
was forced to and that is the way that i

157
00:06:37,440 –> 00:06:40,160
manage the truce

158
00:06:38,800 –> 00:06:41,840
in my case

159
00:06:40,160 –> 00:06:43,360
i hope to be there next year and share

160
00:06:41,840 –> 00:06:45,520
with you the outcome of my experience

161
00:06:43,360 –> 00:06:49,420
which is crazy

162
00:06:45,520 –> 00:06:58,639
so guys keep on hugging

163
00:06:49,420 –> 00:07:01,680
[Applause]

164
00:06:58,639 –> 00:07:03,360
so the device that he was holding

165
00:07:01,680 –> 00:07:05,599
on the video that looked like an ism

166
00:07:03,360 –> 00:07:10,400
camera

167
00:07:05,599 –> 00:07:12,800
it’s just a very sad misunderstanding

168
00:07:10,400 –> 00:07:15,680
because the police hadn’t taken it when

169
00:07:12,800 –> 00:07:17,120
they searched his house as well as 30

170
00:07:15,680 –> 00:07:18,479
hard drives

171
00:07:17,120 –> 00:07:20,800
and he doesn’t get those devices back

172
00:07:18,479 –> 00:07:21,759
because the police are saying that this

173
00:07:20,800 –> 00:07:23,840
was

174
00:07:21,759 –> 00:07:25,199
would take way too much time to look at

175
00:07:23,840 –> 00:07:28,080
everything

176
00:07:25,199 –> 00:07:28,080
so what we learn is

177
00:07:28,560 –> 00:07:32,240
it makes kind of makes sense

178
00:07:34,639 –> 00:07:37,840
to keep

179
00:07:35,680 –> 00:07:40,080
127.001

180
00:07:37,840 –> 00:07:40,080
as